1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

// Robust header parsing for routing decisions
interface ParsedHeaders {
  get(name: string): string | undefined;
  getAll(name: string): string[];
  has(name: string): boolean;
}
 
class HeaderParser implements ParsedHeaders {
  private headers: Map<string, string[]> = new Map();
 
  constructor(rawHeaders: Record<string, string | string[]>) {
    for (const [key, value] of Object.entries(rawHeaders)) {
      const normalizedKey = key.toLowerCase().trim();
      const values = Array.isArray(value) ? value : [value];
      
      // Handle comma-separated values (except for Set-Cookie which uses multiple headers)
      const parsed = normalizedKey === 'set-cookie' 
        ? values 
        : values.flatMap(v => v.split(',').map(s => s.trim()));
      
      this.headers.set(normalizedKey, parsed);
    }
  }
 
  get(name: string): string | undefined {
    const values = this.headers.get(name.toLowerCase());
    return values?.[0];
  }
 
  getAll(name: string): string[] {
    return this.headers.get(name.toLowerCase()) ?? [];
  }
 
  has(name: string): boolean {
    return this.headers.has(name.toLowerCase());
  }
}
 
// Example: Parse Authorization header for routing
function extractBearerToken(headers: ParsedHeaders): string | null {
  const auth = headers.get('authorization');
  if (!auth) return null;
  
  const match = auth.match(/^Bearer\s+(.+)$/i);
  return match ? match[1] : null;
}
 
// Example: Parse tenant from host or custom header
function extractTenant(headers: ParsedHeaders): string | null {
  // Try custom header first
  const tenantHeader = headers.get('x-tenant-id');
  if (tenantHeader) return tenantHeader;
  
  // Fall back to subdomain extraction
  const host = headers.get('host');
  if (host) {
    const match = host.match(/^([^.]+)\.api\.example\.com$/);
    if (match) return match[1];
  }
  
  return null;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

// Comprehensive header matching implementation
type HeaderMatchType = 
  | { type: 'exact'; value: string; caseSensitive?: boolean }
  | { type: 'prefix'; value: string }
  | { type: 'suffix'; value: string }
  | { type: 'regex'; pattern: RegExp }
  | { type: 'present'; inverted?: boolean }
  | { type: 'range'; start: number; end: number };
 
interface HeaderMatcher {
  name: string;
  match: HeaderMatchType;
}
 
function matchHeader(
  headers: ParsedHeaders, 
  matcher: HeaderMatcher
): boolean {
  const value = headers.get(matcher.name);
  const exists = value !== undefined;
 
  switch (matcher.match.type) {
    case 'present':
      return matcher.match.inverted ? !exists : exists;
 
    case 'exact':
      if (!exists) return false;
      return matcher.match.caseSensitive
        ? value === matcher.match.value
        : value.toLowerCase() === matcher.match.value.toLowerCase();
 
    case 'prefix':
      return exists && value.startsWith(matcher.match.value);
 
    case 'suffix':
      return exists && value.endsWith(matcher.match.value);
 
    case 'regex':
      return exists && matcher.match.pattern.test(value);
 
    case 'range':
      if (!exists) return false;
      const num = parseFloat(value);
      return !isNaN(num) && 
             num >= matcher.match.start && 
             num < matcher.match.end;
 
    default:
      return false;
  }
}
 
// Combine multiple header matchers (AND logic)
function matchAllHeaders(
  headers: ParsedHeaders,
  matchers: HeaderMatcher[]
): boolean {
  return matchers.every(m => matchHeader(headers, m));
}
 
// Example usage:
const matchers: HeaderMatcher[] = [
  { name: 'X-Tenant-ID', match: { type: 'exact', value: 'acme-corp' } },
  { name: 'Authorization', match: { type: 'present' } },
  { name: 'X-Client-Version', match: { type: 'regex', pattern: /^2\.[0-9]+/ } },
];
 
// Routes to premium-tier backend if:
// - Tenant is acme-corp AND
// - Request is authenticated AND
// - Client version starts with 2.x

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

# Envoy route configuration for multi-tenant routing
routes:
  # Premium tenant: dedicated infrastructure
  - match:
      prefix: "/api/"
      headers:
        - name: "x-tenant-id"
          exact_match: "enterprise-acme"
    route:
      cluster: acme-dedicated-cluster
      timeout: 30s
      retry_policy:
        num_retries: 3
        
  # Enterprise tier: dedicated cluster group
  - match:
      prefix: "/api/"
      headers:
        - name: "x-tenant-tier"
          exact_match: "enterprise"
    route:
      cluster: enterprise-cluster-pool
      # Higher timeouts for enterprise
      timeout: 60s
      
  # Regional routing for EU tenants (GDPR)
  - match:
      prefix: "/api/"
      headers:
        - name: "x-tenant-region"
          exact_match: "eu"
    route:
      cluster: eu-west-1-cluster
      
  # Default: shared infrastructure
  - match:
      prefix: "/api/"
    route:
      cluster: shared-cluster
      timeout: 10s

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

// Gateway-based A/B cohort assignment and routing
import crypto from 'crypto';
 
interface Experiment {
  id: string;
  feature: string;           // Feature being tested
  variants: ExperimentVariant[];
  salt: string;              // Experiment-specific salt
  targeting?: TargetingRule[]; // Optional targeting rules
}
 
interface ExperimentVariant {
  id: string;
  weight: number;            // 0-100 percentage
  backend: string;           // Target backend cluster
}
 
interface TargetingRule {
  type: 'header' | 'percentage' | 'userList';
  // Rule-specific config
}
 
/**
 * Deterministic cohort assignment using consistent hashing
 * Same user always gets same variant for an experiment
 */
function assignCohort(
  userId: string, 
  experiment: Experiment
): ExperimentVariant {
  // Create deterministic hash from user + experiment
  const hash = crypto
    .createHash('sha256')
    .update(`${userId}:${experiment.id}:${experiment.salt}`)
    .digest();
  
  // Convert to number in range [0, 100)
  const bucket = (hash.readUInt32BE(0) % 10000) / 100;
  
  // Find variant based on weight distribution
  let cumulative = 0;
  for (const variant of experiment.variants) {
    cumulative += variant.weight;
    if (bucket < cumulative) {
      return variant;
    }
  }
  
  // Fallback to last variant
  return experiment.variants[experiment.variants.length - 1];
}
 
/**
 * Route request based on experiment configuration
 */
function routeExperiment(
  headers: ParsedHeaders,
  experiments: Experiment[]
): { backend: string; experimentHeaders: Record<string, string> } {
  const experimentHeaders: Record<string, string> = {};
  let selectedBackend: string | null = null;
  
  // Check for explicit cohort header first (client-assigned)
  const explicitCohort = headers.get('x-experiment-cohort');
  if (explicitCohort) {
    // Validate cohort exists and get backend
    // ... validation logic
    experimentHeaders['X-Experiment-Source'] = 'client';
  }
  
  // Extract user identifier for cohort assignment
  const userId = extractUserId(headers);
  if (!userId) {
    return { backend: 'default-cluster', experimentHeaders };
  }
  
  // Evaluate each active experiment
  for (const experiment of experiments) {
    // Check targeting rules (e.g., internal-only, percentage rollout)
    if (!evaluateTargeting(headers, experiment.targeting)) {
      continue;
    }
    
    const variant = assignCohort(userId, experiment);
    experimentHeaders[`X-Experiment-${experiment.id}`] = variant.id;
    
    // First matching experiment determines backend
    // (or implement priority/combination logic)
    if (!selectedBackend) {
      selectedBackend = variant.backend;
    }
  }
  
  experimentHeaders['X-Experiment-Source'] = 'gateway';
  
  return {
    backend: selectedBackend || 'default-cluster',
    experimentHeaders,
  };
}
 
function extractUserId(headers: ParsedHeaders): string | null {
  // Try JWT first
  const auth = headers.get('authorization');
  if (auth?.startsWith('Bearer ')) {
    // Decode JWT and extract user_id claim
    // ... JWT decoding
  }
  
  // Fall back to session cookie
  const cookies = headers.get('cookie');
  // ... cookie parsing
  
  return null;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

# Istio VirtualService for canary with header override
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: user-service
spec:
  hosts:
    - user-service
  http:
    # Rule 1: Explicit canary header routes to canary
    - match:
        - headers:
            x-canary:
              exact: "true"
      route:
        - destination:
            host: user-service
            subset: canary
          weight: 100
            
    # Rule 2: Internal users (by header) get canary
    - match:
        - headers:
            x-user-type:
              exact: "internal"
      route:
        - destination:
            host: user-service
            subset: canary
          weight: 100
            
    # Rule 3: Weighted split for remaining traffic
    - route:
        - destination:
            host: user-service
            subset: stable
          weight: 95
        - destination:
            host: user-service
            subset: canary
          weight: 5
---
# DestinationRule defines subsets
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: user-service
spec:
  host: user-service
  subsets:
    - name: stable
      labels:
        version: v1.2.3
    - name: canary
      labels:
        version: v1.3.0-canary

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

// Parse and evaluate Accept header with quality values
interface MediaType {
  type: string;      // e.g., "application"
  subtype: string;   // e.g., "json"
  quality: number;   // 0.0 - 1.0, default 1.0
  params: Record<string, string>;
}
 
/**
 * Parse Accept header into ranked media types
 * Example: "application/json, application/xml;q=0.9, */*;q=0.1"
 */
function parseAcceptHeader(accept: string): MediaType[] {
  const mediaTypes: MediaType[] = [];
  
  for (const part of accept.split(',')) {
    const [mediaRange, ...paramParts] = part.trim().split(';');
    const [type, subtype] = mediaRange.split('/');
    
    const params: Record<string, string> = {};
    let quality = 1.0;
    
    for (const param of paramParts) {
      const [key, value] = param.trim().split('=');
      if (key === 'q') {
        quality = parseFloat(value) || 1.0;
      } else {
        params[key] = value;
      }
    }
    
    mediaTypes.push({
      type: type.trim(),
      subtype: subtype?.trim() || '*',
      quality,
      params,
    });
  }
  
  // Sort by quality, descending
  return mediaTypes.sort((a, b) => b.quality - a.quality);
}
 
/**
 * Select best matching backend based on Accept header
 */
interface ContentRoute {
  mediaType: string;  // e.g., "application/json"
  backend: string;
}
 
function routeByContentType(
  acceptHeader: string | undefined,
  routes: ContentRoute[],
  defaultBackend: string
): string {
  if (!acceptHeader) {
    return defaultBackend;
  }
  
  const preferences = parseAcceptHeader(acceptHeader);
  
  for (const pref of preferences) {
    for (const route of routes) {
      const [routeType, routeSubtype] = route.mediaType.split('/');
      
      // Check for match (considering wildcards)
      const typeMatch = pref.type === '*' || pref.type === routeType;
      const subtypeMatch = pref.subtype === '*' || pref.subtype === routeSubtype;
      
      if (typeMatch && subtypeMatch) {
        return route.backend;
      }
    }
  }
  
  return defaultBackend;
}
 
// Example usage:
const contentRoutes: ContentRoute[] = [
  { mediaType: 'application/json', backend: 'json-api' },
  { mediaType: 'application/xml', backend: 'xml-legacy-api' },
  { mediaType: 'text/html', backend: 'web-ui' },
];
 
// Accept: application/json → json-api
// Accept: text/html, application/json;q=0.9 → web-ui
// Accept: */* → json-api (first defined)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

# Complex routing combining path and header conditions
routes:
  # Priority 1: Enterprise tenant on v2 canary (explicit opt-in)
  - match:
      prefix: "/api/v2"
      headers:
        - name: "x-tenant-tier"
          exact_match: "enterprise"
        - name: "x-canary"
          exact_match: "true"
    route:
      cluster: v2-enterprise-canary
 
  # Priority 2: Enterprise tenant on v2 stable
  - match:
      prefix: "/api/v2"
      headers:
        - name: "x-tenant-tier"
          exact_match: "enterprise"
    route:
      cluster: v2-enterprise-stable
 
  # Priority 3: v2 canary (percentage-based for standard tenants)
  - match:
      prefix: "/api/v2"
    route:
      weighted_clusters:
        clusters:
          - name: v2-standard-stable
            weight: 95
          - name: v2-standard-canary
            weight: 5
 
  # Priority 4: v1 for enterprise (legacy support)
  - match:
      prefix: "/api/v1"
      headers:
        - name: "x-tenant-tier"
          exact_match: "enterprise"
    route:
      cluster: v1-enterprise
 
  # Priority 5: v1 default
  - match:
      prefix: "/api/v1"
    route:
      cluster: v1-standard
 
  # Priority 6: Root redirect to v2
  - match:
      prefix: "/api"
      headers:
        - name: "accept"
          prefix_match: "application/json"
    redirect:
      path_redirect: "/api/v2"
      response_code: TEMPORARY_REDIRECT

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

# Envoy header manipulation for security
http_filters:
  - name: envoy.filters.http.lua
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
      inline_code: |
        function envoy_on_request(request_handle)
          -- Remove potentially spoofed internal headers
          request_handle:headers():remove("x-internal-user-id")
          request_handle:headers():remove("x-admin-override")
          
          -- Validate tenant header if present
          local tenant = request_handle:headers():get("x-tenant-id")
          if tenant and not tenant:match("^[a-z0-9%-]+$") then
            request_handle:respond({[":status"] = "400"}, "Invalid tenant ID")
            return
          end
          
          -- Add request tracing
          local request_id = request_handle:headers():get("x-request-id")
          if not request_id then
            request_id = generate_uuid()
            request_handle:headers():add("x-request-id", request_id)
          end
        end
        
  - name: envoy.filters.http.router
 
# Request header size limits
common_http_protocol_options:
  max_headers_count: 100
  max_stream_duration: 30s